Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for improving error messages, with some overly broad activation wording but no code execution, credential access, persistence, or data exfiltration behavior.
Before installing, be aware that the skill may be invoked for broad debugging, support, or productivity wording, so users should explicitly invoke it when they want error-message copy or troubleshooting-message improvements. No evidence suggests it runs code or accesses sensitive data.
The trigger sentence is so generic that it can match ordinary user requests about help, workflows, or support without a clear requirement to invoke this specific skill. Overly broad activation increases the chance of unintended routing, causing the agent to apply this skill in contexts where it is irrelevant, which can mis-handle user intent or suppress more appropriate skills.
The invocation guidance does not clearly define boundaries for when the skill should and should not activate, which makes misrouting likely. In an agent system, ambiguous activation logic is dangerous because it can override more appropriate skills, produce irrelevant outputs, or expose internal workflow behavior in contexts where the user did not request it.
The trigger phrase is so generic that normal user requests about error messages or practical help could activate the skill unintentionally. Over-broad activation can cause the agent to invoke this skill outside its intended scope, creating prompt-routing confusion and increasing the chance that unrelated or sensitive conversations are processed under this skill's instructions.
The trigger phrases are broad enough to match ordinary help requests about productivity, support, debugging, and workflows, which can cause the skill to activate outside its intended scope. Over-broad invocation increases the chance of inappropriate routing, prompt hijacking of unrelated tasks, or unnecessary exposure of user context to a skill that was not explicitly chosen.
The skill description is extremely broad and covers generic domains like productivity, debugging, support, workflows, artifacts, and implementation help. In agent-routing systems, this can cause the skill to activate for many unrelated requests, increasing the chance it overrides more specific safeguards or is used in contexts the author did not intend.
The trigger keywords are common, high-frequency terms with no meaningful constraints, so the skill may be invoked by routine conversations unrelated to error-message improvement. Overbroad triggering expands the skill's effective authority surface and can lead to misrouting, prompt interference, or unreviewed application in sensitive troubleshooting contexts.
The example trigger sentences normalize vague, everyday phrasing as sufficient for activation, which further trains routing logic toward false-positive invocation. Because the skill's operational scope is broad already, these examples make accidental selection more likely and may displace more specialized skills or controls.
The skill description and usage guidance are broad enough to match generic productivity, support, debugging, and user-feedback requests rather than a narrowly scoped task. This can cause the skill to activate in situations outside its intended purpose, increasing the chance of inappropriate instruction injection into unrelated workflows or overshadowing a more suitable, safer skill.
The keyword list includes common, high-frequency terms like 'debugging', 'support', and 'troubleshooting' without requiring an error-message-specific context. In a skill-routing system, such broad triggers can lead to over-selection, causing the skill to intercept many ordinary requests and potentially produce irrelevant or misleading outputs.
The default prompt uses a very broad natural-language invocation phrase tied to common support and productivity requests. In combination with agent routing, this can cause unintended activation during ordinary conversation, exposing users to unsolicited skill behavior or prompt-context injection pathways when the user did not explicitly request this skill.
Enabling implicit invocation without trigger constraints or exclusion conditions allows the skill to auto-activate based on ambiguous context. This increases the chance of misrouting, unintended data exposure to the skill, and adversarial prompting through ordinary user text that happens to match the broad topic area.
The usage signals and trigger examples lack clear boundaries, exclusions, and specificity, making the skill eligible for activation across a wide range of normal productivity or debugging conversations. This ambiguity can be exploited indirectly through prompt phrasing to steer the agent into invoking the skill unnecessarily, degrading routing integrity and increasing the risk of irrelevant or misleading assistance.
This README is labeled as a Chinese-language file, yet key user-facing sections such as the demand description and workflow explanation are written in English. That can amount to a language/locale policy issue because the file implicitly forces mixed-language usage without user opt-in or justification.
